Create private SQLite database files

Pre-create new SQLite database files with mode 0600 on Unix before
opening them with rusqlite. Existing database files are left unchanged.

This requires database names to resolve to ordinary filesystem paths.
SQLite's :memory: name and file: URI filenames are now rejected.

This keeps persisted node and payment data from being readable by other
local users when the database is created under a permissive umask.

This commit was created with assistance from Codex.

Author: tankyleo

src/io/sqlite_store/mod.rs

@@ -9,7 +9,11 @@
 use std::collections::HashMap;
 #[cfg(test)]
 use std::fs;
+#[cfg(unix)]
+use std::fs::OpenOptions;
 use std::future::Future;
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicI64, AtomicU64, Ordering};
 use std::sync::{Arc, Mutex};
@@ -59,6 +63,8 @@ impl SqliteStore {
 	/// If not already existing, a new SQLite database will be created in the given `data_dir` under the
 	/// given `db_file_name` (or the default to [`DEFAULT_SQLITE_DB_FILE_NAME`] if set to `None`).
 	///
+	/// SQLite's `:memory:` database name and `file:` URI filenames are not supported.
+	///
 	/// Similarly, the given `kv_table_name` will be used or default to [`DEFAULT_KV_TABLE_NAME`].
 	pub fn new(
 		data_dir: PathBuf, db_file_name: Option<String>, kv_table_name: Option<String>,
@@ -233,6 +239,12 @@ impl SqliteStoreInner {
 		data_dir: PathBuf, db_file_name: Option<String>, kv_table_name: Option<String>,
 	) -> io::Result<Self> {
 		let db_file_name = db_file_name.unwrap_or(DEFAULT_SQLITE_DB_FILE_NAME.to_string());
+		if db_file_name == ":memory:" || db_file_name.starts_with("file:") {
+			return Err(io::Error::new(
+				io::ErrorKind::InvalidInput,
+				"SQLite :memory: and file: database names are not supported",
+			));
+		}
 		let kv_table_name = kv_table_name.unwrap_or(DEFAULT_KV_TABLE_NAME.to_string());
 
 		create_dir_all_private(&data_dir).map_err(|e| {
@@ -245,6 +257,16 @@ impl SqliteStoreInner {
 		})?;
 		let mut db_file_path = data_dir.clone();
 		db_file_path.push(db_file_name);
+		#[cfg(unix)]
+		match OpenOptions::new().create_new(true).write(true).mode(0o600).open(&db_file_path) {
+			Ok(_) => {},
+			Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {},
+			Err(e) => {
+				let msg =
+					format!("Failed to create database file {}: {}", db_file_path.display(), e);
+				return Err(io::Error::new(io::ErrorKind::Other, msg));
+			},
+		}
 
 		let mut connection = Connection::open(db_file_path.clone()).map_err(|e| {
 			let msg =
@@ -701,6 +723,47 @@ mod tests {
 		}
 	}
 
+	#[cfg(unix)]
+	#[test]
+	fn creates_private_database_storage() {
+		use std::os::unix::fs::PermissionsExt;
+
+		let mut data_dir = random_storage_path();
+		data_dir.push("creates_private_database_storage");
+		let db_file_name = "test_db";
+		let db_file_path = data_dir.join(db_file_name);
+		let _store = SqliteStore::new(
+			data_dir.clone(),
+			Some(db_file_name.to_string()),
+			Some("test_table".to_string()),
+		)
+		.unwrap();
+
+		let dir_mode = data_dir.metadata().unwrap().permissions().mode();
+		let file_mode = db_file_path.metadata().unwrap().permissions().mode();
+		assert_eq!(dir_mode & 0o077, 0);
+		assert_eq!(file_mode & 0o077, 0);
+	}
+
+	#[test]
+	fn rejects_sqlite_pseudo_filenames() {
+		for db_file_name in [":memory:", "file:/tmp/node.db?mode=rwc"] {
+			let data_dir = random_storage_path();
+			let result = SqliteStore::new(
+				data_dir.clone(),
+				Some(db_file_name.to_string()),
+				Some("test_table".to_string()),
+			);
+			let error = match result {
+				Ok(_) => panic!("SQLite pseudo-filename was accepted"),
+				Err(e) => e,
+			};
+
+			assert_eq!(error.kind(), io::ErrorKind::InvalidInput);
+			assert!(!data_dir.exists());
+		}
+	}
+
 	#[tokio::test]
 	async fn read_write_remove_list_persist() {
 		let mut temp_path = random_storage_path();